Ransomware attacks used to carry a strong impression of being the work of highly skilled attackers.
Building the malware. Implementing the encryption. Finding a way in. Setting up payment and ransom negotiation. Dealing with the victim company. This entire chain required considerable expertise and operational capability.
Today, however, ransomware has become a criminal business with a division of labor.
The most prominent form of this is Ransomware-as-a-Service, or RaaS. Ransomware developers provide the tools and infrastructure used in attacks, and other criminals rent them to carry out the attacks.
This is not simply a story of "ransomware getting stronger." What matters more is that more people can take part in ransomware attacks.
What Is Ransomware-as-a-Service?
Ransomware-as-a-Service, or RaaS for short, is a criminal model that turns ransomware into a service.
With legitimate SaaS, companies subscribe to and use software in the cloud. With RaaS, criminals use ransomware tools, management consoles, payment infrastructure, leak sites, technical support and more.
It is, of course, an illegal criminal service, but structurally it imitates a legitimate software business.
| Role | What they do |
|---|---|
| RaaS operator | Provides the ransomware itself, the management infrastructure, payment mechanisms, leak sites and more |
| Affiliate | A criminal who finds targets, breaks in and carries out the attack |
| Initial access broker | A criminal who sells access to compromised networks or stolen credentials (IAB) |
| Negotiator | Handles ransom negotiations with, and pressure on, the victim company |
| Money launderer | Helps move and conceal proceeds obtained in cryptocurrency and other forms |
The criminals carrying out the attacks do not have to develop ransomware from scratch. They can use ready-made criminal infrastructure and focus on the attack itself.
RaaS Is Crime as a Division of Labor
What makes RaaS so troublesome is that attacks are divided into specialized roles.
Rather than one attacker doing everything, multiple roles combine to form a single attack.
- One criminal steals credentials
- Another criminal sells access to a corporate network
- The RaaS operator supplies the ransomware tools
- An affiliate carries out the attack
- Someone else threatens the victim company and pushes for payment
This division of labor makes attackers more efficient.
Ransomware developers can earn money by letting multiple affiliates use their tools, without having to attack each company themselves. Affiliates, in turn, find it easier to start attacks by relying on outside criminal services for the technically difficult parts.
As a result, ransomware is moving from "an attack carried out only by a few sophisticated criminals" toward "an attack you can buy on the criminal market."
RaaS Is Dangerous Because It Lowers the Barrier to Attack
The biggest problem with RaaS is that it lowers the barrier to entry for ransomware attacks.
In the past, attackers needed knowledge of malware development, network intrusion, encryption, operational infrastructure, ransom negotiation and more.
With RaaS, however, attackers may be able to carry out attacks using existing tools and procedures without understanding everything.
That is a major shift for companies.
Defenders are not just up against a small number of sophisticated ransomware groups. They need to plan their defenses with everyone in mind: RaaS affiliates, copycats, low-skilled criminals and attackers who combine different criminal services.
RaaS Is Part of a Larger Criminal Economy
RaaS does not exist in isolation.
On dark markets and criminal forums, each component needed for an attack is bought and sold separately:
- Stolen IDs and passwords
- Initial access to corporate networks
- Phishing kits
- Malware distribution infrastructure
- The ransomware itself
- Sites for publishing leaked data
- Money-laundering assistance
Among these, initial access brokers play a particularly important role.
Attackers may not need to break in themselves; they can sometimes buy access to already compromised VPNs, RDP, cloud accounts, administrator credentials and the like. From there, they deploy ransomware using RaaS.
In other words, an "entry point" into your company could already be on sale in a criminal market without you knowing it.
Why RaaS Is Especially Dangerous for Companies
RaaS expands the scale of attacks.
With traditional ransomware, the attack group's own headcount and skill set the limit on how many attacks it could carry out. With RaaS, however, an operator can take on many affiliates and target many companies at the same time.
RaaS is also structured to be persistent:
- Even if some affiliates are arrested, the operating infrastructure may survive
- Even if infrastructure is taken down, operations may resume under a different name
- A brand that has become too well known may be abandoned and activity continued under a new name
- Attack methods may change by combining with other criminal services
Takedowns by law enforcement are extremely important. But in a division-of-labor criminal economy like RaaS, takedowns alone will not necessarily make it disappear completely.
In fact, the U.S. Department of Justice conducted a disruption operation against the Hive ransomware group. Hive is said to have targeted more than 1,500 organizations in over 80 countries, and it was announced that the FBI obtained and provided decryption keys, allowing victims to avoid paying roughly $130 million in ransom.
This case shows the effectiveness of law enforcement, but it also shows that ransomware can cause major damage on a global scale before it is stopped.
RaaS and Double Extortion
Modern ransomware does not simply encrypt files.
In many attacks, data is stolen before it is encrypted. Attackers then use two levers to pressure the company:
- Demanding payment to restore the encrypted files
- Demanding payment to keep the stolen data from being published
This is double extortion.
In recent years, we have also seen multi-extortion, which combines several forms of pressure, such as contacting business partners and customers, DDoS attacks and announcing upcoming publication on leak sites.
In that case, even if you can restore your systems from backups, not every problem is solved.
If customer information, contracts, employee information, financial documents, source code or unpublished management materials have been stolen, it becomes a crisis response that spans legal, PR, customer communications and dealings with regulators.
Where Do RaaS Attacks Start?
RaaS attacks do not begin with some kind of special magic.
In many cases, the entry point is a common security weakness.
In Sophos's 2025 ransomware survey, the technical root causes identified by victim organizations were exploited vulnerabilities (32%), compromised credentials (23%), malicious email (19%) and phishing (18%).
In other words, the entry points are quite ordinary:
- Unpatched vulnerabilities
- Stolen passwords
- VPNs and cloud services without multi-factor authentication
- Phishing emails
- Malicious attachments
- Internet-exposed admin consoles
- Weak administrator accounts
- Compromised contractors and business partners
RaaS affiliates do not necessarily use advanced techniques. More often, they exploit basic weaknesses that have been left unaddressed.
AI Makes the RaaS Problem Even Bigger
RaaS alone is dangerous enough, but adding AI makes it even more troublesome.
RaaS provides the tools needed for ransomware attacks. AI could make the work of the criminals using those tools faster, more convincing and broader in scope.
| Work AI can assist with | Risk to companies |
|---|---|
| Writing phishing emails | More attacks that look like business emails written in natural Japanese |
| Researching target companies | Executives, departments and services in use are more easily mapped from public information |
| Analyzing stolen data | Information useful for pressure, such as customer data and contracts, is easier to find |
| Writing attack scripts | Even low-skilled criminals can more easily prepare attacks |
| Writing ransom notes | Natural, high-pressure messages tailored to each company can be produced |
RaaS provides the tools for attack, and AI assists with the work of attacking. This combination may make ransomware attacks more accessible, more numerous and more convincing.
Traditional Ransomware vs. RaaS
| Aspect | Traditional ransomware | Ransomware-as-a-Service |
|---|---|---|
| Required skill | Attackers themselves need high technical skill | Ready-made tools lower the technical barrier |
| Malware development | Developed by the attacker or attack group | Provided by the RaaS operator |
| Attacker structure | Centered on a single attack group | Split between operators and multiple affiliates |
| Revenue model | Attack directly and collect the ransom | Usage fees, success fees, profit sharing and more |
| Scale | Depends on the attack group's capabilities | Easier to expand through an affiliate network |
| Support | Depends on internal knowledge | Technical support for criminals may be provided |
| Risk to companies | Severe | Severe, and more likely to be widespread |
The biggest difference is scale.
Traditional attacks depend on the attackers' own capabilities. RaaS turns ransomware into something closer to a "product" that many criminals can use.
What Happens to a Company Hit by a RaaS Attack
When a RaaS attack succeeds, a company faces multiple impacts at the same time:
- Business system outages
- Encryption of file servers and core systems
- Leaks of customer and confidential information
- Lost revenue opportunities
- Notifying customers and business partners
- Legal investigations and dealings with regulators
- Reviews and negotiations over cyber insurance
- Recovery and investigation costs
- Damage to brand trust
- Long-term recovery work
Small and midsize businesses often lack dedicated security staff or adequate backup arrangements, so an attack can directly threaten business continuity.
For large enterprises, too, the sheer number of systems, users, contractors and the volume of data means a wider attack surface.
Regardless of company size, assuming "we won't be targeted" is dangerous. In schemes like RaaS, attackers search broadly for targets, so a weakness found by chance can lead to damage.
How Companies Can Prepare for RaaS
Companies cannot make RaaS itself disappear.
But they can put themselves in a position where they are harder to attack, where attacks are harder to spread even after a breach, and where damage can be kept small.
1. Enforce multi-factor authentication
Stolen passwords can be an entry point for RaaS attacks.
Multi-factor authentication should be applied to email, VPN, cloud services, administrator accounts, remote access and critical business applications.
For accounts with administrator privileges and internet-facing services in particular, avoid relying on passwords alone.
2. Prioritize fixing critical vulnerabilities
RaaS affiliates sometimes target known vulnerabilities.
What matters is not simply compiling a list of vulnerabilities but fixing the ones most likely to be attacked first:
- Internet-facing systems
- Vulnerabilities that can be exploited without authentication
- Vulnerabilities with publicly available exploit code
- VPN and remote access appliances
- Admin consoles and file transfer services
Patching needs to follow a risk-based approach.
3. Protect your backups
Backups are an important pillar of ransomware defense.
But backups that attackers can delete or encrypt are not enough as a means of recovery.
- Keep offline or immutable backups
- Separate backup accounts from production administrators
- Test restores regularly
- Set the recovery order for each critical system
- Monitor for backup deletion and mass changes
You need to confirm not that "we have backups," but that "we can restore after an attack."
4. Minimize privileges
Ransomware tries to move laterally after it gets in.
With excessive privileges, compromise of a single account can spread damage widely.
- Remove unnecessary administrator privileges
- Reduce shared accounts
- Promptly disable accounts of departing and transferred employees
- Review access rights on file servers
- Audit the use of privileged accounts
Least privilege is unglamorous, but it is critical for narrowing the scope of damage.
5. Monitor for suspicious behavior
Ransomware can show warning signs before encryption begins.
If you notice early, you may be able to prevent company-wide encryption and data leaks. Watch for:
- Unusual logins
- Mass file access in a short period
- Privilege escalation attempts
- Suspicious PowerShell or script execution
- Large outbound data transfers
- Attempts to delete backups
- Unusual encryption activity
It is important not just to deploy detection tools, but also to decide who reviews alerts and how the initial response is handled.
6. Run modern phishing training
Phishing emails are more convincing than they used to be.
With AI, attackers can produce messages in natural-sounding Japanese tailored to the recipient's work.
Rather than judging by typos alone, employees need to build verification habits such as:
- Verifying that the sender is legitimate
- Confirming sudden payment requests through a separate channel
- Being wary of links that ask for credentials
- Checking the context before opening attachments
- Reporting to the security team when in doubt
Rather than asking employees only to "spot" attacks, it is also important to provide a system that makes reporting easy.
7. Segment your network
On a flat network, ransomware spreads more easily after an intrusion.
Critical systems, backups, management networks, general endpoints, development environments and the like should be properly segmented and access-controlled.
Ideally, the design should ensure that even if a single endpoint is compromised, it cannot reach the company's servers or backups.
8. Prepare an incident response plan
Deciding who decides what after a ransomware attack hits is too late.
The following should be worked out in advance:
- The lead for initial response
- Internal contact lists
- Escalation procedures to legal, PR and executives
- Which external experts to consult
- Reporting procedures to the police and relevant authorities
- Procedures for restoring from backup
- A policy for explaining the situation to customers and business partners
An incident response plan is not finished once it is written. It needs to be kept usable through tabletop exercises and restore tests.
In the RaaS Era, Steady Investment in the Basics Pays Off
Ransomware-as-a-Service has changed the economics of ransomware.
Attackers no longer need to build everything themselves. They can rent tools, buy entry points, join attacks as affiliates and use criminal infrastructure.
With AI added to the mix, phishing copy may become more natural, analysis of stolen data faster and ransom demands more personalized.
In short, RaaS lowers the barrier to attack, and AI increases the speed of attack. This combination is a very real risk for companies.
That said, the direction of defense does not change much.
Multi-factor authentication, vulnerability management, backup protection, least privilege, network segmentation, monitoring, employee training and incident response planning. None of these are new terms, but they matter even more in the RaaS era.
Ransomware is no longer the preserve of a few sophisticated attackers. It is important to assume it will keep spreading as a criminal service, and to take a fresh look at your entry points, privileges and means of recovery.
